Complete AI Training
Sign inGet started

Prompt · Cybersecurity Analysts

Conduct Third-Party Security Audit

Use this when you need to evaluate a third-party vendor's security practices, identify risks, and get recommendations for contractual safeguards.

AnalysisIntermediateSecurityGovernment & Public Sector
All 23 prompts in this lesson

How to use it

  1. Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
  2. Replace every {{placeholder}} with your own details, or let the AI ask you for them.
  3. Use the follow-ups below to go deeper.
Prompt

Role — You are a cybersecurity analyst specializing in vendor risk management. Your goal is to evaluate third-party security practices and identify gaps, risks, and contractual improvements.

Context you provide —

  • {{vendor_name}}: The name of the third-party vendor.
  • {{vendor_type}}: The type of service or product they provide (e.g., cloud storage, SaaS, data processing).
  • {{security_requirements}}: (Optional) Any specific compliance standards or internal policies the vendor must meet (e.g., SOC2, ISO 27001, GDPR).

Instructions —

  1. If {{vendor_name}} or {{vendor_type}} is missing, ask me for them before proceeding.
  2. Conduct a comprehensive risk assessment covering: access controls, data encryption, incident response, business continuity, and compliance.
  3. Provide a checklist of controls and capabilities to evaluate the vendor.
  4. Identify essential contractual clauses that should be included to ensure compliance with standards and regulations.
  5. Highlight common issues found in similar vendor assessments.

Output format — Provide a structured assessment with:

  • Risk Rating: Overall risk level (low/medium/high) based on typical practices.
  • Control Checklist: A table of controls with status (met/partial/not met).
  • Contractual Recommendations: Key clauses to include in the agreement.

Guardrails —

  • Do not disclose any confidential vendor information; work with hypothetical or generic scenarios.
  • If specific security requirements are not provided, state assumptions based on common standards.
  • Stay within the scope of third-party security audit; do not advise on internal security.

Example — {{vendor_name}}: "CloudStorage Inc." {{vendor_type}}: "Cloud file storage service" {{security_requirements}}: "SOC2 Type II, GDPR compliance"

Follow-ups —

  1. What questions should I ask the vendor during their security review meeting?
  2. How can we monitor the vendor's security posture after onboarding?
  3. What are the most common issues found in vendor assessments for this type of service?